CVE-2026-43494

Last refreshed2026-10-17

Status: UPDATED | Advisory ID: CVE-2026-43494

Key Details

CVE	CVE-2026-43494
CVSS Score / Version	7.8 (High) / CVSS v3.1
Updated	2026-10-16
CVSS Vector	`CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H`
CVSS Prose	attack vector is local; attack complexity is low; privileges required is low; user interaction is none; scope is unchanged; confidentiality impact is high; integrity impact is high; availability impact is high.
Affected products	Linux Kernel
Classified as	CWE-1341 (Multiple Releases of Same Resource or Handle)

Vendor	Product	Affected Versions	Patch Status
Linux	Linux Kernel

Vendor

Product

Affected Versions

Patch Status

Linux

Linux Kernel

Subsystems	OT Supporting Infrastructure
Sectors	All Sectors

In the Linux kernel, the following vulnerability has been resolved:

net/rds: reset op_nents when zerocopy page pin fails

When iov_iter_get_pages2() fails in rds_message_zcopy_from_user(),

the pinned pages are released with put_page(), and

rm->data.op_mmp_znotifier is cleared. But we fail to properly

clear rm->data.op_nents.

Later when rds_message_purge() is called from rds_sendmsg() the

cleanup loop iterates over the incorrectly non zero number of

op_nents and frees them again.

Fix this by properly resetting op_nents when it should be in

rds_message_zcopy_from_user(). (NVD)

Monitor Linux's web page for any future patch releases.

Source	Reference
NVD	https://nvd.nist.gov/vuln/detail/CVE-2026-43494
CVE	https://www.cve.org/CVERecord?id=CVE-2026-43494

Source

Reference

NVD

CVE